CVE-2023-38039: haxx curl +9 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2023-38039

CVSS 7.5 · High EPSS 58,1%

Kerentanan Allocation of Resources Without Limits or Throttling pada haxx curl, fedoraproject fedora +8 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

Rincian

Terbit di NVD: 15 September 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari): 58,1% peluang dieksploitasi; lebih tinggi dari 99,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
haxx	curl	Versi 7.84.0 hingga sebelum 8.3.0
fedoraproject	fedora	Versi 37
fedoraproject	fedora	Versi 38
fedoraproject	fedora	Versi 39
microsoft	windows 10 1809	Semua versi sebelum 10.0.17763.5122
microsoft	windows 10 21h2	Semua versi sebelum 10.0.19044.3693
microsoft	windows 10 22h2	Semua versi sebelum 10.0.19045.3693
microsoft	windows 11 21h2	Semua versi sebelum 10.0.22000.2600
microsoft	windows 11 22h2	Semua versi sebelum 10.0.22621.2715
microsoft	windows 11 23h2	Semua versi sebelum 10.0.22631.2715
microsoft	windows server 2019	Semua versi sebelum 10.0.17763.5122
microsoft	windows server 2022	Semua versi sebelum 10.0.20348.2113

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://hackerone.com/reports/2072338 exploit · issue tracking · patch · advisory pihak ketiga
http://seclists.org/fulldisclosure/2023/Oct/17 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2024/Jan/34 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2024/Jan/37 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2024/Jan/38 mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202310-12 advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20231013-0005/ advisory pihak ketiga
https://support.apple.com/kb/HT214036 advisory pihak ketiga
https://support.apple.com/kb/HT214057 advisory pihak ketiga
https://support.apple.com/kb/HT214058 advisory pihak ketiga
https://support.apple.com/kb/HT214063 advisory pihak ketiga
https://www.insyde.com/security-pledge/SA-2023064 advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOX... mailing list
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276... mailing list
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS... mailing list

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.